The WooCommerce Multivendor Marketplace REST API plugin is vulnerable to SQL injection as the ‘id’ parameter in the update_delivery_status() function is not properly escaped or prepared. Authenticated users with Subscriber-level permissions or higher can inject and append arbitrary SQL statements into the existing query. This flaw, identified as CWE‑89, can be used to extract sensitive data from the database, compromising confidentiality and potentially revealing user information or order details.

The affected product is the WCFM – Multivendor Marketplace REST API for WooCommerce, maintained by wclovers. All versions up to and including 1.6.2 contain the vulnerability. No specific sub‑versions beyond 1.6.2 are listed, so any installation of 1.6.2 or earlier is considered at risk.

The CVSS score of 6.5 indicates a medium severity vulnerability. The EPSS score is reported as < 1%, suggesting a low likelihood of exploitation. The vulnerability is not in the CISA KEV catalog. Because the attack requires an authenticated account with at least Subscriber access, attackers may target sites with a large number of vendor or customer accounts. Exploitation would allow unauthorized data extraction from the database without the need for code execution. The likely attack vector is the REST API endpoint that accepts the ‘id’ parameter, as inferred from the description.